Messages in this thread | | | Subject | Re: [PATCH 1/2] posix-timers: fix posix_timer_event() vs dequeue_signal() race | From | Mark McLoughlin <> | Date | Thu, 24 Jul 2008 16:23:03 +0100 |
| |
On Wed, 2008-07-23 at 20:52 +0400, Oleg Nesterov wrote: > The bug was reported and analysed by Mark McLoughlin <markmc@redhat.com>, > the patch is based on his and Roland's suggestions. > > posix_timer_event() always rewrites the pre-allocated siginfo before sending > the signal. Most of the written info is the same all the time, but memset(0) > is very wrong. If ->sigq is queued we can race with collect_signal() which > can fail to find this siginfo looking at .si_signo, or copy_siginfo() can > copy the wrong .si_code/si_tid/etc. > > In short, sys_timer_settime() can in fact stop the active timer, or the user > can receive the siginfo with the wrong .si_xxx values. > > Move "memset(->info, 0)" from posix_timer_event() to alloc_posix_timer(), > change send_sigqueue() to set .si_overrun = 0 when ->sigq is not queued. > It would be nice to move the whole sigq->info initialization from send to > create path, but this is not easy to do without uglifying timer_create() > further. > > As Roland rightly pointed out, we need more cleanups/fixes here, see the > "FIXME" comment in the patch. Hopefully this patch makes sense anyway, and > it can mask the most bad implications. > > Reported-by: Mark McLoughlin <markmc@redhat.com>
I've re-tested and can confirm that the patch fixes the test case at:
http://markmc.fedorapeople.org/test-posix-timer-race.c
Cheers, Mark.
| |